The Missing Chain of Custody
A PI is hired by a business to investigate internal theft. During a walk-through, the PI finds a USB drive in a break room and a handwritten note in a desk drawer belonging to an employee. The PI photographs both, pockets the USB drive, and later plugs it into his own laptop to see the contents. He interviews two employees without recording the interviews and takes notes in a spiral notebook. Three weeks later, the employer terminates the employee, who files a wrongful termination claim. The employer's attorney asks for the PI's file, including the USB drive and notebook. The PI cannot recall exactly which drawer the note came from or the order of the interviews.
1. Identify the evidence-handling failures and explain why each matters in the anticipated litigation.
Read the worked answer
Failures: (1) No chain of custody for the USB drive - who found it, where, when, who handled it. Without this, authenticity can be challenged and the drive may be excluded. (2) Inserting the drive into a personal laptop - alters potential metadata and risks contaminating or destroying evidence; a forensic copy should have been made. (3) Removing the note without documenting location - the PI cannot now testify where it was found, undermining its relevance and the lawfulness of the search. (4) No recording and vague notes - interview content becomes the PI's memory versus the employees', weakening reliability.
Each failure converts a potentially strong case into a credibility contest the employer may lose.
2. What should the PI have done differently at each step, and how should he respond to the attorney's document request now?
Read the worked answer
At each step: photograph and log the USB drive in place, bag and label it, maintain a written chain-of-custody form, and image it forensically rather than opening it on a personal device. Document the note's exact location before moving it. Record interviews (with consent where required) or at minimum take contemporaneous, dated notes and have witnesses review/sign.
Now: produce the full file honestly, including the notebook and drive, and disclose the handling gaps rather than conceal them. Prepare a written reconstruction of what can be established (dates, locations, sequence) and flag what cannot. Candor about the gaps lets counsel manage the damage; hiding them guarantees it surfaces at the worst moment.